AML Risk Scoring for Crypto: How to Score Transactions Using Exposure, Asset and Blockchain Distance

Two crypto deposits of $25,000 arrive at an exchange. One comes directly from a wallet linked to an investment scam. The other has $500 in identifiable exposure to a protocol hack, with several intermediary transfers and a token swap along the way. Despite their identical value, these transactions present very different risk profiles.

For compliance teams, understanding these differences in AML risk scoring for crypto is essential when deciding whether to credit a deposit, investigate an alert, or request additional information.

An AML risk score provides a starting point, but interpreting it requires looking at the underlying evidence: where the funds came from, how much is exposed, which assets and networks are involved, and how far the transaction sits from an identified risk source.

This guide explains how AML risk scoring for crypto works, which factors influence transaction assessments, and how blockchain distance affects the interpretation of exposure. 

What Is AML Risk Scoring for Crypto?

In crypto AML risk scoring, the assessed object also matters:

• Address risk concerns the attribution and transaction history available for a wallet address. Its owner may be unknown.
• Transaction risk concerns a particular incoming or outgoing transfer and the exposure traceable to it.
• Customer risk covers the broader relationship, including Know Your Customer (KYC) information, expected activity and historical behavior.

A low-risk customer may still receive scam-linked funds. Transaction and customer assessments therefore serve different purposes.

For an incoming deposit, the transaction assessment begins with reconstructing the transfer and identifying its observable exposure.

How Does Crypto Transaction Risk Scoring Work?

Crypto transaction risk scoring can be examined in four stages. The first three establish exposure evidence; the fourth is the institution’s decision:

1. Identify the activity: value, asset, network, direction and counterparties.
2. Trace and attribute funds: follow observable paths to identifiable entities within provider coverage.
3. Assess exposure: category, attribution confidence, share, amount, asset path and distance, using the provider's methodology.
4. Apply policy: consider customer context, restrictions and thresholds before processing, reviewing or holding funds.

In practice, crypto AML risk scoring depends on what tracing establishes about the risk source, exposed amount and confidence in attribution.

What Determines a Crypto Transaction's AML Risk Score?

Risk source and attribution. An AML risk score may reflect links to fraud, a hack, a mixer or a sanctioned entity. Category indicates severity; confidence indicates how securely a wallet is linked to the source. An address explicitly listed by an authority and one associated with a listed entity through heuristics require different levels of attribution confidence.

Share and value. Two percent of $1 million is $20,000; 60% of $500 is $300. Severe categories such as sanctions can warrant action even at small amounts.

Direction. Source of Funds checks incoming exposure; Use of Funds checks outgoing destinations and observable onward transfers. Each direction needs its own assessment.

Asset and network influence which routes can be reconstructed; distance describes the observable path. This becomes especially important when funds change assets or pass through contracts before reaching an exchange.

How Do Asset and Network Affect Crypto Transaction Risk Assessment?

A crypto transaction risk assessment must account for how the asset moves. Bitcoin may combine transaction inputs and split outputs. Ethereum and Tron token transfers may involve smart contracts; swaps change assets and bridges connect networks. Following earlier exposure requires traceable connections across those operations. Contracts can also create attribution gaps.

In Global Ledger's October 2026 Binance investigation, stolen tokens moved through wallets and decentralized exchanges before conversion into ETH. The reconstructed routes show why tracing must sometimes continue across an asset change; a DEX interaction alone does not establish illicit activity.

Study-level data provide context. Global Ledger's High-Risk Benchmark examined BTC, ETH and USDT on Tron flows across 99 centralized exchanges in 2021–2025. USDT on Tron represented 81% of identified sanctions-related risky inflows, while BTC accounted for 87.7% of hack-related risky inflows. The identified high-risk share of deposit value was 1.24% for USDT on Tron and 0.51% for BTC. These are exposure rates, not asset criminality ratings or scoring weights. See the stablecoin AML analysis for the underlying asset comparison.

Some assets face separate legal restrictions. For example, EU Regulation 2026/506 lists A7A5 and RUBx under asset-specific restrictions, with different effective dates. The applicable regime and jurisdiction matter.

Distance then describes the source's or destination's proximity to the screened activity. Even when the funds can be followed across an asset change, the number and nature of intervening transfers affect how the link is interpreted.

Distance then describes the source's or destination's proximity to the screened activity.

How Does Blockchain Distance Change the Assessment?

A blockchain hop is an observed transfer step along the traced path. For the deposits in this guide, distance is measured from the attributed source to the exchange deposit address. A single transfer between the source and the deposit address is direct exposure; a path involving intervening addresses or contracts is indirect. Source of Funds is traced backward, while Use of Funds is examined toward outgoing destinations.

Swaps can generate several token-transfer legs within one blockchain transaction, and providers can count depth differently. The example counts illustrated fund-flow legs, not necessarily separate blockchain transactions.

Global Ledger's 2021–2025 benchmark used a five-hop research window. The 2025 value-weighted mean distance was 3.06 hops for sanctions exposure and 1.80 for hack exposure, as described in its sanctions-screening analysis. Five hops defined that study's scope, not a recommended universal cutoff.

Unobserved exposure needs to remain an explicit limitation. If a trace stops at a contract, the missing earlier path cannot be treated as confirmed low risk.

Worked Example: Two Transactions, Different Risk Profiles

Let's look at two hypothetical deposits of $25,000 each arriving at the same crypto exchange. Both have the same value, but tracing their Source of Funds reveals very different risk profiles.

In Deposit A, the exchange receives $25,000 in USDT on Tron directly from a wallet attributed to an investment scam. The funds travel in a single transfer, creating 100% direct exposure to the identified source.

This gives the compliance team a clear reason to investigate. But before deciding what to do with the deposit, the analyst needs to verify the attribution and understand the customer's relationship with the sender. Receiving funds from a scam-linked wallet does not necessarily mean the customer participated in the scam.

Deposit B involves a more complicated route. Around $500 worth of ETH originates from a wallet linked to a protocol hack. The funds pass through a decentralized exchange (DEX), where ETH is swapped for USDC, and reach the customer's wallet. Another $24,500 in USDC arrives from a separate source with no identified high-risk connection.

The customer then transfers the combined $25,000 to the exchange. As a result, approximately 2% of the deposit is traceable to the hack, through three illustrated transfer legs.

Here's how these two fund flows compare: 

Illustrative fund flows showing direct scam exposure and indirect hack exposure through a DEX swap. The three illustrated legs in Deposit B may involve additional on-chain events depending on how the provider counts blockchain hops.

The difference becomes clear once the transactions are examined side by side. Deposit A has a direct connection to an identified scam source, covering the entire amount. Deposit B has a much smaller connection to a hack, several steps away from the exchange.

These differences matter for blockchain transaction risk assessment, although the resulting numerical scores depend on the provider's methodology. A small, indirect exposure can still warrant investigation, particularly if the hack occurred recently or new attribution reveals additional risky connections along the route.

The available evidence also determines what the analyst needs to investigate next. For Deposit A, the priority is verifying the sender and the customer's connection to the scam-linked wallet. For Deposit B, it is confirming the tracing path, the reliability of attribution, and the circumstances of the hack.

With those findings, the exchange can apply its risk policies to decide whether each deposit should be credited, held, or reviewed further.

From Risk Score to Compliance Decision

An exchange may hold Deposit A while verifying the sender and requesting source-of-funds information. Deposit B might be credited under monitoring or reviewed, depending on hack severity, timing, tracing confidence and policy.

Well-calibrated AML transaction monitoring rules combine category, value, exposure depth and customer context. Backtesting shows which alerts a rule would raise and how much review work it creates. Sanctions-related cases must also follow applicable restrictions and the institution's sanctions-screening workflow.

The audit record should preserve the original risk report, rule version, rationale and action. Newly attributed intermediaries can trigger reassessment without obscuring the original decision.

How Global Ledger Supports Transaction Risk Scoring

GL's reports connect scoring to its underlying evidence. Global Ledger's GL Score provides a 0–100 rating based on four publicly documented inputs: entity risk, Source of Funds risk, Use of Funds risk and address risk. Its bands are 0–29 low, 30–69 medium and 70–100 high. Sanctioned-entity exposure can score high even at small amounts. Exact weights are unpublished; GL documents no separate asset-risk weight.

Global Ledger KYT provides Source and Use of Funds analysis, direct and indirect exposure information, transaction-flow tracing and risk alerts. Compliance teams can customize counterparty risk scores, test rules on existing data and access histories of alerts, API calls, scoring changes and cases. These records support reviews and audits.

The value of retaining that evidence becomes most apparent when an exchange needs to explain a decision after the original screening, particularly if the attribution has since changed.

Conclusion

The example with two $25,000 deposits illustrates why transaction value alone tells compliance teams so little about the actual risk. What matters is the evidence behind each transfer: the source of the exposure, the amount of affected funds, the reliability of attribution, and the path those funds took before reaching the exchange.

For crypto businesses, effective AML risk scoring means having this information available when decisions need to be made. Teams should be able to identify which transactions warrant further investigation, apply their risk-based policies consistently, and document the reasons behind each decision. They also need to reassess previously screened activity when new attribution or sanctions information changes the risk profile.

Global Ledger KYT supports this process by combining transaction risk scores with Source and Use of Funds analysis, direct and indirect exposure data, and ongoing monitoring. This gives compliance teams the context they need to investigate alerts, make informed decisions, and maintain a clear record of their assessments.

FAQ